Agentic PrimitivesAGENTIC PRIMITIVES

03 · Agent frameworks

No framework leads every layer. The one layer none of them claims is the one we are ahead on.

The capability everyone is selling is a composition of eight layers — edge, harness, orchestration, durability, context, authority, evidence, observability. The field maturing validates the architecture. Its one unclaimed layer, intent-bound delegated authority, is ahead here for a structural reason no framework can copy cheaply: the frameworks treat the ability to call a tool as the authority to act. We separate them, and prove the separation on chain.

Scorecard — verdicts we can defend

Intent-bound delegated authority
leader: nobody
ahead

Mandates, per-step verify, attenuation, revocation, digest binding — all on chain, demonstrated live 2026-09-03.

Signed, bound agent cards
leader: Mastra
ahead

JWS + EIP-712 binding to the SA — bound to an identity, not a key.

Skills as executable semantic contracts
leader: Pydantic (closest)
ahead

SkillExecutionContractV1 + the archetype compiler; the authority shape of every tool recorded and diffed on upgrade.

Receipts and evidence chain
leader: nobody
ahead

In model; anchoring and signing waves still landing.

Knowledge and context contract
leader: MAF context providers
ahead

Two tiers live — generated CONSTRUCT over the public KB, compiled selectors over vaults — with evidence in every answer. Packaging lift pending.

Policy interception
leader: Strands / Cedar
at par

The risk ladder at par; on-chain enforcers beneath it are ours alone.

Tracing · evaluation · replay
leader: LangSmith
at par

Firewalled GenAI spans + OTLP; replay re-derives verdicts; PROV graph is record-form only.

A2A 1.0 wire · cards · tasks
leader: ADK · Mastra
at par

Wire, cards and tasks live; the official TCK run in CI is a program item.

Human-in-the-loop
leader: LangGraph · Dapr
at par

Input-required + approval port live; approval waits surviving restart are a wave.

Multi-agent patterns (handoff · supervisor · group chat)
leader: MAF · CrewAI
different by design

Between-agent work is an Endeavor with a child delegation per participant, never a loop operator.

Graph / state orchestration operators
leader: LangGraph
behind

sequence / parallel / branch / join are program waves.

Durable execution (checkpoint · resume · durable waits)
leader: Dapr · MAF
behind

Durable tasks yes; run checkpoints and resume-with-recheck are a wave; engine adapters live outside Ring 0.

Managed control plane / run UI
leader: LangSmith · AgentOS
deliberately absent

Ring 0 ships data and events; product repos render.

Model / provider breadth
leader: MAF · ADK
deliberately absent

Adapters behind one Planner port; budget-routed.

Verdicts are cut from the maintained analysis and re-cut when a framework ships something that changes one. Status claims about our own code match the program’s wave tables — never ahead of them.

Per framework — best at · what we take · where we differ

Microsoft Agent Framework

The enterprise architecture reference — agent / workflow / hosting / context-provider / hooks separation; sequential, concurrent, handoff, group-chat, Magentic; a durable extension; FIDES information flow.

take · The context-provider boundary (prepare / observe) and hooks as middleware, never authority.

differ · FIDES + hooks + approvals never amount to an intent-bound mandate. Their supervise / group-chat live inside the loop; ours are the coordination plane, because between-agent scheduling without a signed commitment is decided by a component that cannot be held to it.

Google ADK

A2A-native, multi-language; sessions / state / memory as separate concepts; resumability.

take · The local-subagent vs remote-A2A-agent distinction — one A2A message, one receipt, never in-process.

differ · ADK identity is deployment identity. Ours is the SA address; an agent survives its runtime being replaced.

LangGraph · Deep Agents · LangSmith

Graph state, durable checkpoints, interrupts, time travel; an opinionated harness; a mature ops platform with traces becoming evals.

take · Checkpoint semantics; production traces as evaluation datasets — ours is the AUTHORITY test set.

differ · LangSmith replay re-plays what happened. Ours must re-derive the authority decisions against recorded state; a replay that reuses old verdicts is a defect here.

Dapr Agents

GA distributed durability — durable workflows, resume after failure, durable human approvals, pre-invocation hooks, mTLS.

take · “Agent reliability is distributed-systems primitives, not serialized chat history” — why a Run is an A2A Task in a Durable Object.

differ · Dapr identity authenticates workloads. A workload is never an agent here; which agent it may act as is a signed binding, what it may do is a mandate.

Agno AgentOS

One self-hosted runtime exposing agents, teams, workflows over A2A; RBAC; persisted approvals.

take · One runtime, many archetypes — our derived agent types on one SA substrate.

differ · AgentOS RBAC is standing permission on endpoints. Our gate asks why now: same endpoint, same caller, different sentence is a deny.

Strands

Intervention handlers with explicit precedence (deny / confirm / guide / transform / proceed); Cedar authorization.

take · The intervention point — the closest analog to where verifyMandateForStep sits.

differ · Cedar evaluates standing rules (“a Treasurer may pay < $1,000”). A mandate is contextual: pay THIS payee ≤ THIS amount for THIS intent until THIS time after THIS approval.

Mastra

TypeScript DX; A2A 0.3 + 1.0 with task lifecycle, signed cards, a local Studio.

take · Their documented caveat — A2A task records are in-memory — is the lesson: protocol-level task support ≠ durable execution.

differ · Our cards are released, JWS-signed and EIP-712 bound to an on-chain identity, not just signed by a deployment key.

Pydantic AI + Harness

A typed loop where every harness feature is a composable Capability; deferred SKILL.md loading; two published security lessons.

take · Both lessons are doctrine here: skill visibility never authorizes; client approval is not a boundary — which is why approval becomes a redemption precondition on chain.

differ · Their Capability is a feature toggle. Ours is a semantic identity that mandates name, discovery matches and receipts cite.

CrewAI

Role-oriented crews plus deterministic flows.

take · The crews / flows split restates our coordination / orchestration split.

differ · A CrewAI role is prompt configuration. Ours is a situation-plane record that grants nothing; the delegation does.

OpenAI Agents SDK

The minimal loop — agents-as-tools, handoffs, guardrails, serializable HITL state.

take · Proof the loop should stay small; our orchestration core is ~400 lines for the same reason.

differ · Their handoff is in-process. Ours crosses an authority boundary with a child delegation.

Buzz.xyz (Block)

A human + agent workspace on Nostr: agents as first-class members with keypairs, one permission framework, workflows that pause for approval, external runtimes over ACP.

take · Triggers as playbook-declared automations; ACP runtimes admitted as member agents under scoped delegations — “your Goose agent, with on-chain-revocable scope.”

differ · It is our Home’s shape on a weaker trust base: identity is a keypair (no custody, recovery or revocation), permission is an ACL, approval is a click. Ours: a signature, a grant, a revocation.

What we must not do in response

  • — Build a framework. The loop stays small; capabilities are ports. The day the orchestration core grows a supervise(), we have rebuilt MAF badly.
  • — Re-implement on-chain properties as policy. The verifier mirrors the chain for early refusal and evidence; the chain remains the enforcement.
  • — Let OAuth, RBAC or Cedar drift inward as authority. They answer who and what standing rules; only the mandate answers why now.
  • — Adopt a workflow vendor in Ring 0. Ports and one Durable Object binding; Dapr, Temporal, DBOS, Restate are adapters.
  • — Ship a run UI from the primitives repo.